Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS v.9.2.1 allow a local attacker to execute arbitrary code via a crafted script to the Forms of the Data objects.

**ConcreteCMS Cross-site Scripting vulnerability**

Moderate severity GitHub Reviewed Published Oct 6, 2023 to the GitHub Advisory Database • Updated Oct 6, 2023

GHSA-p4jj-gwpg-9jwh: ConcreteCMS Cross-site Scripting vulnerability

A Cross Site Scripting (XSS) vulnerability in Concrete CMS v.9.2.1 allows an attacker to execute arbitrary code via a crafted script to Plural Handle of the Data Objects from System & Settings.

GHSA-6xx7-r8x4-fpjp: ConcreteCMS Cross-site Scripting vulnerability

A Cross Site Scripting (XSS) vulnerability in Concrete CMS v.9.2.1 allows an attacker to execute arbitrary code via a crafted script to the SITE parameter from installation or in the Settings.

GHSA-j6h5-ggv2-3rfv: ConcreteCMS Cross-site Scripting vulnerability

A Cross Site Scripting (XSS) vulnerability in Concrete CMS v.9.2.1 allows an attacker to execute arbitrary code via a crafted script to the Tags from Settings - Tags.

GHSA-6fm3-r6mf-j875: ConcreteCMS Cross-site Scripting vulnerability

SAP Application Server ABAP and ABAP Platform suffer from an open redirection vulnerability.

SEC Consult Vulnerability Lab Security Advisory < 20231005-0 >  
=======================================================================  
               title: Open Redirect in BSP Test Application it00  
                      (Bypass for CVE-2020-6215 Patch)  
             product: SAP® Application Server ABAP and ABAP®  
                      Platform (SAP_BASIS)  
  vulnerable version: see section "Vulnerable /  tested versions"  
       fixed version: see SAP security note 3258950  
          CVE number: CVE-2020-6215  
              impact: medium  
            homepage: https://www.sap.com  
               found: 2022-09-23  
                  by: Fabian Hagg (Office Vienna)  
                      SEC Consult Vulnerability Lab

                      An integrated part of SEC Consult, an Eviden business  
                      Europe | Asia

                      https://www.sec-consult.com

=======================================================================

Vendor description:  
-------------------  
"SAP is one of the world’s leading producers of software for the management of  
business processes."[1]

[1] https://www.sap.com/about/what-is-sap.html

Business recommendation:  
------------------------  
By exploiting the vulnerability documented in this advisory, attackers  
can redirect users to arbitrary sites. Targeted users of such an  
attack may be victims of successful phishing attempts jeopardizing the  
confidentiality of logon information or other data.

SEC Consult recommends to implement the security note 3258950, where the  
documented issue is fixed according to the vendor. We advise installing  
the correction as a matter of priority to keep business-critical data secure.

Vulnerability overview/description:  
-----------------------------------  
1) Open Redirect Vulnerability (Patch bypass of CVE-2020-6215)  
The sample Business Server Pages (BSP) application it00 suffers from an open  
redirect vulnerability that is referred to by CVE-2020-6215 [2]. A patch  
for this issue was made available via SAP Security Note 2872782 [3].  
During analysis, it was identified that the patch is insufficient and can  
be bypassed.

[2] https://nvd.nist.gov/vuln/detail/CVE-2020-6215  
[3] https://me.sap.com/notes/2872782

Proof of concept:  
-----------------  
1) Open Redirect Vulnerability (Patch bypass of CVE-2020-6215)  
The following source code excerpt of event handler OnInputProcessing() of  
BSP subpage transition_navigation.htm shows that by the implementation of  
SAP Security Note 2872782, an additional check was introduced that validates  
the HTTP request parameter ‘applicationUrl’ against pseudo-headers ~server_name,  
respectively ~server_name_expanded. Thus, to verify that the provided URL  
complies with these values to only allow redirects to the local server,  
the IF condition checks if the specified ‘applicationUrl’ parameter contains  
the host name of the local server. Only if this check is evaluated successfully,  
the browser of the calling user gets redirected to the intended page.

---------------------------------------------------------------------------  
[...]  
when 'call'.  
     data: url1      type string,  
           url2      type string,  
           host_name type string.  
     host_name = request->get_header_field( '~server_name' ).  
     if host_name is initial.  
       host_name = request->get_header_field( '~server_name_expanded' ).  
     endif.  
     url = request->get_form_field( 'applicationUrl' ).  
     if url cs host_name.  
       split url at '?' into url1 url2.  
       url2 = cl_abap_dyn_prg=>escape_xss_url( url2 ).  
       concatenate url1 '?' url2 into url.  
       navigation->call_application( url = url ).  
     endif.  
* negative test cases  
   when 'error_no_such_exit'.  
     navigation->next_page( 'NAVFAIL' ).

endcase.  
---------------------------------------------------------------------------

It was observed that this check can be bypassed, for example, by crafting  
special HTTP requests that contain the host name of the target application  
server (the PoC uses the <app server hostname> placeholder) within the query string  
part of the URL provided via parameter ‘applicationUrl’. To validate this issue,  
the following URL can be browsed to in order to trigger the vulnerability and  
circumvent the implemented patch.

---------------------------------------------------------------------------  
http[s]://<app server hostname>:<ICM port>/sap/bc/bsp/sap/it00/transition_  
navigation.htm?ApplicationURL=http://127.0.0.1:8080/?<app server hostname>  
&onInputProcessing%28call%29=Start+Application  
---------------------------------------------------------------------------

For demonstration purposes, after a successful login, the browser is redirected  
by the application server to localhost on port 8080 (any other host/port pair  
could by specified by the attacker).

The server replies with a "302 Found" message redirecting the browser to the  
localhost address defined in the response Location header field:

---------------------------------------------------------------------------  
HTTP/2 302 Found  
Content-Type: text/html  
Content-Length: 0  
Location: http://127.0.0.1:8080/?<app server hostname>&sap-params=[...]  
---------------------------------------------------------------------------

An attacker can create a URL which would redirect the victim to a malicious  
site, for example, a phishing site convincing the victim to login once again.

Vulnerable / tested versions:  
-----------------------------  
The following version has been tested and found to be vulnerable:

- SAP_BASIS release 755, SP level 01

According to the vendor the following releases and versions  
are affected by the discovered vulnerability:

- SAP_BASIS 700-702  
- SAP_BASIS 731  
- SAP_BASIS 740  
- SAP_BASIS 750-757

Vendor contact timeline:  
------------------------  
2022-10-03: Contacting vendor through vulnerability submission web form.  
2022-10-04: Vendor confirms receipt and assigns internal ID #2270141902.  
2022-10-19: Vendor confirms vulnerability and proposes new CVSS score of  
             5.4 (NLNR|U|LLN).  
2022-10-24: Asking vendor why new CVSS rating differs from initial  
             vulnerability rating. No response.  
2022-11-24: Asking vendor for update.  
2022-11-30: Vendor states that the patch is about to be released with the  
             upcoming Patch Tuesday December 2022.  
2022-12-13: Vendor releases patch with SAP Security Note 3258950.  
2023-10-05: Release of security advisory.

Solution:  
---------  
The vendor provides a patched version which should be installed immediately.  
Patches are available in form of SAP Security Notes which can be accessed  
via the SAP Customer Launchpad [4]. More information can also be found in  
the Official SAP Security Patchday Blog [5].

The following Security Note needs to be implemented: 3258950

[4] https://me.sap.com/app/securitynotes  
[5] https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a&rc=10

Workaround:  
-----------  
Disable BSP test application it00 in the ICF service tree in transaction  
SICF.

Advisory URL:  
-------------  
https://sec-consult.com/vulnerability-lab/

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SEC Consult Vulnerability Lab

SEC Consult, an Eviden business  
Europe | Asia

About SEC Consult Vulnerability Lab  
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an  
Atos company. It ensures the continued knowledge gain of SEC Consult in the  
field of network and application security to stay ahead of the attacker. The  
SEC Consult Vulnerability Lab supports high-quality penetration testing and  
the evaluation of new offensive and defensive technologies for our customers.  
Hence our customers obtain the most current information about vulnerabilities  
and valid recommendation about the risk profile of new technologies.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
Interested to work with the experts of SEC Consult?  
Send us your application https://sec-consult.com/career/

Interested in improving your cyber security with the experts of SEC Consult?  
Contact our local offices https://sec-consult.com/contact/  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mail: security-research at sec-consult dot com  
Web: https://www.sec-consult.com  
Blog: https://blog.sec-consult.com  
Twitter: https://twitter.com/sec_consult

EOF F. Hagg / @2023

SAP Application Server ABAP Open Redirection

Red Hat Security Advisory 2023-5480-01 - Red Hat OpenShift Serverless release of OpenShift Serverless Logic. This release includes security fixes. Issues addressed include a bypass vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Important: Release of OpenShift Serverless Logic 1.30.0 SP1 security update  
Advisory ID:       RHSA-2023:5480-01  
Product:           Red Hat OpenShift Serverless  
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:5480  
Issue date:        2023-10-05  
CVE Names:         CVE-2023-2602 CVE-2023-2603 CVE-2023-4853  
                   CVE-2023-22006 CVE-2023-22036 CVE-2023-22041  
                   CVE-2023-22044 CVE-2023-22045 CVE-2023-22049  
                   CVE-2023-25193 CVE-2023-27536 CVE-2023-28321  
                   CVE-2023-28484 CVE-2023-29469 CVE-2023-29491  
                   CVE-2023-34969  
====================================================================  
1. Summary:

Release of OpenShift Serverless Operator 1.30.1 and OpenShift Serverless  
Logic 1.30.0 SP1

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE links in the References section.

2. Description:

Red Hat OpenShift Serverless release of OpenShift Serverless Logic.

This release includes security fixes.

Security Fix(es):

* quarkus: HTTP security policy bypass (CVE-2023-4853)

For further information about CVE-2023-4853, see the Red Hat Security  
Bulletin link in the References section.

For more details about the security issues, including the impact, a CVSS  
score, acknowledgements, and other related information, refer to the CVE  
pages listed in the References section.

3. Solution:

Before applying this update, make sure all previously released errata  
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

4. Bugs fixed (https://bugzilla.redhat.com/):

2238034 - CVE-2023-4853 quarkus: HTTP security policy bypass

5. References:

https://access.redhat.com/security/cve/CVE-2023-2602  
https://access.redhat.com/security/cve/CVE-2023-2603  
https://access.redhat.com/security/cve/CVE-2023-4853  
https://access.redhat.com/security/cve/CVE-2023-22006  
https://access.redhat.com/security/cve/CVE-2023-22036  
https://access.redhat.com/security/cve/CVE-2023-22041  
https://access.redhat.com/security/cve/CVE-2023-22044  
https://access.redhat.com/security/cve/CVE-2023-22045  
https://access.redhat.com/security/cve/CVE-2023-22049  
https://access.redhat.com/security/cve/CVE-2023-25193  
https://access.redhat.com/security/cve/CVE-2023-27536  
https://access.redhat.com/security/cve/CVE-2023-28321  
https://access.redhat.com/security/cve/CVE-2023-28484  
https://access.redhat.com/security/cve/CVE-2023-29469  
https://access.redhat.com/security/cve/CVE-2023-29491  
https://access.redhat.com/security/cve/CVE-2023-34969  
https://access.redhat.com/security/vulnerabilities/RHSB-2023-002  
https://access.redhat.com/security/updates/classification/#important  
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index  
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.11/html/serverless/index  
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.12/html/serverless/index  
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.13/html/serverless/index

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIcBAEBCAAGBQJlHypBAAoJENzjgjWX9erEKGkP/jYGGRUGra0tizCgOISt3wpS  
YKNeBdag+cSMriReV9XSse2/SYWd0CXtynbDZfQYyP7EmXik03/7Rf/o5h92OJ4c  
jxrJF4mCmc0dFW31HEefguylonyMKp75XFZb0+hnAaFU4BfjzNIw8DpOcF3JP7Q7  
revr5B95oWRHcfG/Wy+9g0texu7ilFlYR5Hp3eYbntkstfpOMIYHjnvYF7fDN9Ty  
4AG6aAUnR0UOT5rEZE9GtGaeK+MIMbR8bnjud+NcCuYXktnGNTMhUxEa8uguh7pM  
Q7hG+n6cAOYKb3kGkhCMwrfRE0TrFgkbQ0r4PoFsWll6TEV5UdBRDE5KCnUxBDjU  
9CweYlI1veEx/dfpR17bOgtik6RaRsku3mUp4+3Arp8i5MMUFCWC20oyi382T/NA  
EpkehRCOJk0PWgYsZ8jvPlJqgitgrpN4rIyljN4utTxFlTyZlVJyYLXPcRg0/N3t  
4gFaIFqtrgumLmfgrMe6/PqmA8mRcZENsZiDeoB/zxdOGLZ4lJpgZt2/gOjONWkL  
A6P+XhzLfp5BVUf4HCua2pQnk/W96ooKabsvhTc1kGb7z8f09JuNxLTIiaj+m7Jt  
EMwqNxjH3hpoRF2XfOvVR0IM/G26siMpxHkqof9YA8I/St2HDpCKFn7B/ofQRMni  
9J9AvIfhEJHOpvztziJH  
=zYgu  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2023-5480-01

**ConcreteCMS Stored XSS v.9.2.1****Author: (Sergio)**

**Description:** Multiple Cross Site Scripting vulnerability in ConcreteCMS v.9.2.1 allows a local attacker to execute arbitrary code via a crafted script to the Forms of the Data objects.

**Attack Vectors:** Scripting A vulnerability in the sanitization of the entry in the Forms of "Data Objects" allows injecting JavaScript code that will be executed when the user accesses the web page.

**POC:**

When logging into the panel, we will go to the "System & Settings - Express - Data Objects from section off Dashboard Menu and we select one.

Within the chosen Data object, we go to the Forms option:

We click on the "Add Form" option: 

In the details of the form we choose "Add Field Set":

Next, we choose the + option to add data to the form field:

The vulnerability works with various fields, for example with "Core Properties - Text":

Finally we edit the content to add the payload:

**XSS Payload:**

<\><img src\=1 onerror\=alert('Custom')\>

We add the indicated payload in the "Custom Label" field:

In the following image you can see the embedded code that executes the payload in the main web. 

As I have indicated, it works in different fields, such as the following:

  
**Additional Information:**

https://www.concretecms.com/

https://owasp.org/Top10/es/A03\_2021-Injection/

CVE-2023-44761: GitHub - sromanhu/ConcreteCMS-Stored-XSS---Forms: Cross Site Scripting vulnerability in ConcreteCMS v.9.2.1 allows a local attacker to execute arbitrary code via a crafted script to the Form of the Da

**ConcreteCMS XSS v2.2.18****Author: (Sergio)**

**Description:** Cross Site Scripting vulnerability in ConcreteCMS v.9.2.1 allows a local attacker to execute arbitrary code via a crafted script to Plural Handle of the Data Objects from System & Settings.

**Attack Vectors:** Scripting A vulnerability in the sanitization of the entry in the Plural Handle of "Data Objects from System & Settings" allows injecting JavaScript code that will be executed when the user accesses the web page.

**POC:**

When logging into the panel, we will go to the "System & Settings - Data Objects." section off General Menu.

We edit the Entity field with the payload that we have created and see that we can inject arbitrary Javascript code in the Plural Handle field.

**XSS Payload:**

""\><svg/onload\=alert('PluralHandle')\>

Then we add an association:

And we add the Type to Many to Many to add the payload to "Target Property Name and Inversed Property Name":

We execute the association created:

In the following image you can see the embedded code that executes the payload in the main web.

  
**Additional Information:**

https://www.concretecms.com/

https://owasp.org/Top10/es/A03\_2021-Injection/

CVE-2023-44765: GitHub - sromanhu/ConcreteCMS-Stored-XSS---Associations: Cross Site Scripting vulnerability in ConcreteCMS v.9.2.1 allows a local attacker to execute arbitrary code via a crafted script to the Plural 

**ConcreteCMS Stored XSS v.9.2.1****Author: (Sergio)**

**Description:** Cross Site Scripting vulnerability in ConcreteCMS v.9.2.1 allows a local attacker to execute arbitrary code via a crafted script to the SITE parameter from installation or in the Settings.

**Attack Vectors:** Scripting A vulnerability in the sanitization of the entry in the Site of Installation or Settings allows injecting JavaScript code that will be executed when the user accesses the web page.

**POC:**

In the installation process we add the payload in the SITE parameter:

**XSS Payload:**

<img src\=x:alert(alt) onerror\=eval(src) alt\='XSS Site'\>

In the following image you can see the embedded code that executes the payload in the main web. 

  
**Additional Information:**

https://www.concretecms.com/

https://owasp.org/Top10/es/A03\_2021-Injection/

CVE-2023-44764: GitHub - sromanhu/ConcreteCMS-Stored-XSS---Site_Installation: Cross Site Scripting vulnerability in ConcreteCMS v.9.2.1 allows a local attacker to execute arbitrary code via a crafted script to the SI

**ConcreteCMS Reflected XSS v.9.2.1****Author: (Sergio)**

**Description:** Cross Site Scripting vulnerability in ConcreteCMS v.9.2.1 allows a local attacker to execute arbitrary code via a crafted script to the Tags from Settings - Tags.

**Attack Vectors:** Scripting a vulnerability in the sanitization of the entry in the Tags of "Settings - Tags" allows injecting JavaScript code that will be executed when the user accesses the web page.

**POC:**

When logging into the panel, we will go to the "Settings - Tags section off Dashboard Menu.

**XSS Payload:**

<img src\=x:alert(alt) onerror\=eval(src) alt\='XSS Tags'\>

In the following image you can see the embedded code that executes the payload in the main web. 

  
**Additional Information:**

https://www.concretecms.com/

https://owasp.org/Top10/es/A03\_2021-Injection/

CVE-2023-44762: GitHub - sromanhu/ConcreteCMS-Reflected-XSS---Tags: Cross Site Scripting vulnerability in ConcreteCMS v.9.2.1 allows a local attacker to execute arbitrary code via a crafted script to the Tags from Se

Tag

#xss